3. 2024 08 29 Internal Audit Reports Issued
North Ayrshire Council · 29 August 2024
Back to Audit and Scrutiny Committee — 29 August 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
NORTH AYRSHIRE COUNCIL 29 August 2024 Audit and Scrutiny Committee Title: Internal Audit Reports issued Purpose: To inform the Committee of the findings of Internal Audit work completed between May and July 2024. Recommendation: That the Committee considers the outcomes from the Internal Audit work completed. 1. Executive Summary 1.1 The Council's local Code of Corporate Governance requires effective arrangements to be put in place for the objective review of risk management and internal control. Internal Audit is an important element in this framework as it reviews internal controls and offers Elected Members and officers an objective and independent appraisal of how effectively resources are being managed. 1.2 The remit of the Audit and Scrutiny Committee includes the monitoring of Internal Audit activity. The submission and consideration of regular reports assists the Committee in fulfilling this remit. 2. Background 2.1 This report provides information on Internal Audit work completed between May and July 2024. Internal control reviews have been completed in respect of the areas detailed in Appendix 1 to this report. The aim of these reviews is to provide assurance that the internal control framework within the areas examined is appropriate and operating effectively. 2.2 The findings from each audit assignment have been notified in writing to the Chief Executive, the Section 95 Officer and the relevant Executive Director and Head of Service on the completion of each assignment. Where appropriate, this has included an action plan with recommendations for improving internal control. Appendix 1 includes the report and action plan from each audit. 2.3 The findings from 3 separate audit assignments are detailed at Appendix 1 to this report and the levels of assurance for each are noted in the table below:
Page 2
Audit Title Assurance Level Code of Corporate Governance Substantial Supply Teachers Substantial Payroll Transaction Testing Reasonable 3. Proposals 3.1 It is proposed that the Committee considers the outcomes from the Internal Audit work completed between May and July 2024. 4. Implications/Socio-economic Duty Financial 4.1 None. Human Resources 4.2 None. Legal 4.3 None. Equality/Socio-economic 4.4 None. Climate Change and Carbon 4.5 None. Key Priorities 4.6 The work of Internal Audit helps to support the efficient delivery of the strategic priorities within Our Council Plan 2023-2028. Community Wealth Building 4.7 None. 5. Consultation 5.1 The relevant Services are consulted on Internal Audit findings during each audit assignment.
Page 3
Mark Boyd Head of Service (Finance) For further information please contact Anne-Marie Fenton, Team Manager (Internal Audit), on 01294 324564. Background Papers None.
Page 4
CODE OF CORPORATE GOVERNANCE 1 Background 1.1 The Chartered Institute of Public Finance and Accountancy (CIPFA) and the Society of Local Authority Chief Executives and Senior Managers (SOLACE) published an updated version of their Delivering Good Governance in Local Government Framework in 2016 (“the Framework”). This identified 7 Principles of Good Governance and within each of these a series of sub-principles and behaviours and actions which demonstrate good governance in practice. To support implementation of the Framework, CIPFA and SOLACE also published a set of Guidance Notes for Scottish Authorities (“the Scottish Guidance”). 1.2 North Ayrshire Council’s Internal Audit team test compliance with selected principles of the Framework (and previous versions) on a cyclical basis and the last such audit took place in 2019/20. 2 Objectives and Scope 2.1 The audit gathered evidence to demonstrate compliance with 2 of the 7 Principles of Good Governance as outlined in the Framework. These were: • D: Determining the interventions necessary to optimise the achievement of the intended outcomes. • F: Managing risks and performance through robust internal control and strong public financial management. 3 Findings Principle D: Determining the interventions necessary to optimise the achievement of the intended outcomes 3.1 Members need accurate and timeous information to support their decision making. 3.2 Audit reviewed the Council’s approach to managing the provision of information to Members by considering:- • The Scheme of Administration • Controls around the content of committee papers • How the Council ensures productive communication between Members and Officers • How the Council obtains feedback from residents on strategic issues SCHEME OF ADMINISTRATION 3.3 The Council has a number of Committees. Clarity in terms of the roles, responsibilities and delegated decision making powers of each of these committees is provided via the Council’s Scheme of Administration. COMMITTEE PAPERS
Page 5
3.4 Member are asked to make decisions based on committee papers. The content and completeness of these reports is managed by:- • requiring all papers to follow a predefined template. The Council currently has 2 templates - a general template and a template tailored for planning reports. These templates contain standard headings to prompt the author to consider a number of areas that are important to the Council – both in terms of its aims and objectives, but also its legal obligations. Guidance is also available on the completion of these templates. • having a timetable that officers must follow when submitting reports. This timetable ensures that sufficient time is available for the Head of Service to approve the report, for Committee Services to prepare the agenda and report pack for Members, and for pre-agenda meetings to take place. Pre- agenda meetings allow for clarification and additional information to be requested of officers in advance of the committee meeting. COMMUNICATION BETWEEN MEMBERS AND OFFICERS 3.5 In order to support constructive debate between members and officers, whilst maintaining a strong working relationship, the Council has ‘Guidelines for Member/Officer Relations’. COMMUNICATION WITH RESIDENTS 3.6 The opinions of North Ayrshire residents are heard via Members. 3.7 The Council also engages with residents throughout the year on a number of issues such as:- • Council budget consultation • Progress against the Council Plan • HSCP programmes • Council Housing 3.8 The 2020 Best Value Assurance Report commented very positively on the Council’s citizen and community engagement, and the recent Best Value Thematic Work 2022-23 (dated October 2023) confirmed the Council’s ongoing performance in this area by stating ‘The council’s new priorities were developed from sustained engagement with its communities. The council demonstrates genuine commitment to working with and empowering local communities’. 3.9 All of the above measures ensure that the appropriate decision makers have accurate and timeous information. Principle F: Managing risks and performance through robust internal control and strong public financial management 3.10 Audit has reviewed the Council’s approach in the following areas:- • Managing Performance • Robust Internal Controls • Managing Data • Financial Management • Risk Management
Page 6
MANAGING PERFORMANCE 3.11 The Council Plan sets the strategic aims and objectives of the Council. The achievement of this Plan is monitored via the Council Plan Performance Framework. 3.12 This Framework consists of 26 PI’s and 46 actions and outcomes are formally reported to Cabinet, the Audit & Scrutiny Committee and published on the Council website 6 monthly. 3.13 These reports provide explanations for all PIs that are adrift of target. 3.14 The Council has in place a Performance Dashboard, which is in the process of being refreshed. This will be used to provide up to date performance information from the Framework to the public. 3.15 The Council also monitors its performance against its peers via the Local Government Benchmark Framework (LGBF). Annually the Council produces a report comparing its performance to other Scottish Councils within its ‘family group’ (i.e. councils that are similar in terms of the type of population that they serve (e.g. relative deprivation and affluence) and the type of area in which they serve them (e.g. urban, semi-rural, rural)). 3.16 This Framework covers 110 PIs, but North Ayrshire ensures its report is focussed and meaningful by only including the PIs that it deems most align with the Council Plan. This report is provided to Cabinet, the Audit & Scrutiny Committee and is published on the Council website. 3.17 Services have operational plans. These plans are for internal management and are not published or reported on. Each Head of Service is responsible for the composition, performance measures and monitoring of these plans. 3.18 In December 2023 the Executive Leadership Team (ELT) approved the development of a rolling programme of self-assessment. Operational Plans will form part of the self-assessment process. ROBUST INTERNAL CONTROLS 3.19 The Council’s Financial Regulations make the Chief Executive, Executive Directors and Heads of Service responsible for the maintenance of effective controls within the financial procedures operated by their Services. 3.20 The same Regulations give the Council’s Internal Audit Team the authority to carry out independent reviews on both financial, and other, controls in any area of the Council. 3.21 The Internal Audit Plan is based on a risk-based assessment of areas within the Council. Resources are then allocated to review the controls in areas assessed as higher risk. The Plan is dynamic to allow for ongoing review and to allow for any adjustments to reflect any emerging areas of risk.
Page 7
3.22 All findings are presented to the Audit & Scrutiny Committee and all recommendations arising from reviews are recorded and monitored on Pentana (the Council’s performance management system). Services must justify any actions not completed within agreed timescales. 3.23 Any allegations of fraud or error are investigated by the Council’s Corporate Fraud team, with findings being reported to Audit & Scrutiny Committee. MANAGING DATA 3.24 The Council has a dedicated Data Protection Officer who is tasked with ensuring the Council has a robust data governance framework. 3.25 The Council has a ‘Data Protection Policy’ which covers:- • Data Protection Principles • Notification of Processing Activities • Roles & Responsibilities • Information Sharing • Data Protection Impact Assessment • Management of Data Incidents and Breaches. 3.26 In support of the above policy, the Council also has a range of policies, procedures and guidelines that promote compliance and best practice. These include:- • Acceptable Use Policy • Data Breach Reporting and Management Procedures • Records Management • Data Protection Impact Assessment Framework • Freedom of Information • Information Asset Register • Subject Access Requests • Privacy Notice • Redaction Guidelines • ICT and Cyber Security policy 3.27 Each year all staff must undertake refresher Cyber Security and GDPR training (online via iLearn). DATA SHARING 3.28 The Council’s ‘Data Protection Policy’ states that a data processing and sharing agreement must be in place when sharing personal data with a 3rd party. 3.29 The Council has an Information Governance Procurement Framework (IGPF) to help officers identify any data governance issues that need to be addressed during the procurement process. 3.30 It also prompts officers to complete a Data Protection Impact Assessment (DPIA) if sharing of personal data is identified. This Assessment is designed to support the Officer with identifying and addressing any potential privacy impacts.
Page 8
3.31 The council has an Information Asset Register to record and monitor all information assets throughout the Council. The purpose of the Register is to help officers understand the risks associated to the information held and demonstrate measures taken to protect it throughout its life cycle. The register is reviewed annually. FINANCIAL MANAGEMENT 3.32 An audit of the Council’s Financial Resilience and Viability was carried during 2023/24 during which substantial assurance was obtained with regard the Council’s application of the principles of the CIPFA FM Code. 3.33 CIPFA states that compliance with the FM Code assists local authorities in demonstrating that they are meeting their legislative requirement to have sound financial management. 3.34 Reliance has been placed on this outcome, and no further testing has been undertaken as part of this audit. RISK MANAGEMENT 3.35 The Council has a risk management strategy setting out the Council’s overall approach to risk management. 3.36 It also has a risk management governance guide which sets out the roles and responsibilities of key officers and boards/groups within the Council in terms of risk management. 3.37 Both of these documents are in the process of being refreshed. 3.38 The Council can demonstrate its identification and monitoring of risks via its series of risk registers. The Council uses different risk registers depending on the scope and severity of the risk. The Council’s registers are as follows:- • Strategic risk register – This records top level risks potentially impacting on the objectives of Council, often driven by external factors over which the Council may have limited or no control over. The Corporate Risk Management Group (CRMG) monitors the progress of the action plans relating to this plan 6 monthly and Cabinet approves the annual register update. • Corporate risk register – This records operational riskswhich impact across the organisation, affecting several or all Service areas. CRMG and ELT update this register annually. • Service/Operational risk register – This records operational risks which will be specific to and managed by one Council Service. Services are responsible for updating their registers and escalating any risks to the ELT that they assess to be corporate in nature. • Project risk registers – for risks that relate to specific projects. These are updated as appropriate for the specific needs of the Project. 3.39 The above confirms the Council has robust internal controls in place to mitigate risk and manage performance.
Page 9
4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard the Council’s compliance with Principles D and F of the Delivering Good Governance in Local Government Framework. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 10
SUPPLY TEACHERS 1 Background 1.1 All teachers are required to be registered by the General Teaching Council for Scotland (GTCS). 1.2 Supply teachers are employed directly by the Council and paid according to nationally agreed conditions of services contained in the Scottish Negotiating Committee for Teachers (SNCT). Supply teachers cover short-term and long-term absences. 1.3 SEEMiS had provided a national supply booking system as part of the management information system but this was withdrawn by them in 2021. As a result all 32 Councils in Scotland’s Education services had to find an alternative recording system. NAC opted for Shiftplan, a cloud-based booking system in conjunction with Cloud Cover IT in partnership with Riverside TMA, a local North Ayrshire company. No other authority has chosen this supplier; however, two other authorities have made enquiries with a view to adopting the system. 1.4 The Scottish Government complete an annual survey of teacher numbers every September, this provides an annual snapshot. Since 2006, NAC have employed on average 1,383 teachers per year, in 2022 the population was 1,422, a reduction of 40 from the previous year. The overall teacher numbers since 2006 have reduced by 15. 2 Objectives and Scope 2.1 The main objectives of the audit were to ensure: • sufficient checks are undertaken prior to adding staff to the supply bank register • supply staff are booked in accordance with procedures • supply staff are paid accurately • GTCS records are checked and registration maintained 3 Findings Supply Staff Bank 3.1 The average cost for this system is £32,364 per annum. Core prices have remained static over the 3 years tested. 3.2 Supply teacher recruitment is completed through myjobscotland on an annual basis. Head Teachers support recruitment of staff using the TalentLink back office system which sits behind the myjobscotland website. Standard recruitment checks are completed at this point and HR resourcing complete the process. A letter of employment is issued to the successful teachers. 3.3 Once selected, supply teachers are given access to the Shiftplan system where vacant posts are advertised. There are currently 719 user licences, 131 operators licences and 18 administrator licences. Booking Supply staff 3.4 Comprehensive procedure documents are in place for administration and system operators. Supply teachers also have instructions to set up notifications on their mobile devices.
Page 11
3.5 Teachers on the supply list are required to register their weekly availability. Available supply slots are posted on Shiftplan. These posts can be targeted individually or made available to everyone on the supply register. Once posted the post becomes available to the first person to accept. If no availability is posted within one year, teachers are removed from the list. 3.6 In 2022-23 school year 298 supply teachers were requested to cover the equivalent of 85092.55 hours. Payment of Supply Teachers 3.7 A report is extracted directly from Shiftplan to HR and payment is made. A review of HR Payroll late payment and Off reports did not identify any issues with this process. 3.8 Sample testing matched CHRIS payments to Shiftplan supply teacher register hours worked for school periods 2022/23 and August 2023 to December 2023. No issues were identified. GTCS Records 3.9 All teachers had a GTCS registration number recorded on CHRIS, a sample of 10 was successfully matched to the GTCS website. 4 Internal Audit Opinion 4.1 Overall, substantial assurance was obtained with regard to the recruitment of supply teachers.
Page 12
Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.
Page 13
PAYROLL TRANSACTION TESTING 1 Background 1.1 This audit was conducted as part of the approved 2023/24 Internal Audit Plan and used computer audit software to interrogate the HR Payroll system and examined any anomalies which arose. 1.2 Audit software called IDEA (Interactive Data Extraction and Analysis) has been used to carry out this testing. In addition, Internal Audit are working with the Data Analytics Team to utilise Power BI for future audits. 1.3 The Employee Account is used to access and complete internal online forms for contract amendments and terminations. 1.4 The audit covered the following areas: • Overtime • Working time regulations • Last payment for leavers • Salary amendment • Pay Adjustments 2 Objectives and Scope 2.1 The main objectives of this audit were to ensure that: • High overtime payments are valid and properly authorised and no duplicate overtime payments have been made. • Employees working an average of 48+ hours per week have complied with the working time directive regulations. • Employees last pay is correct, properly authorised and any overpayments have been identified and rectified. • Salary amendments are valid and authorised. • No duplicate pay adjustments have been made. 2.2 The audit covered the period 1st October 2022 to 30th September 2023. 3 Findings Overtime Checks 3.1 The auditor selected a sample of 10 high overtime payments to test. A HSCP employee was found to have been overpaid 2 hours overtime plain due to an addition error on the overtime sheet resulting in an overpayment of £41.14 and this has been rectified by the Service. In addition, 4 of the overtime forms did not record the reason for the overtime. 3.2 The auditor tested for potential duplicate overtime payments by testing the same overtime hours to the same employee for the same overtime date but paid in a different payruns. There were 20 potential duplicate overtime payments found and a sample of 10 were selected to check. This resulted in the identification of 3 duplicate overtime payments which are detailed below. 3.3 A Facilities Management employee has been overpaid £422.38 for 30.5 overtime hours keyed twice for period ending 10/01/23. However, this employee was also underpaid £78.40 for the same overtime date due to the incorrect weekly contracted hours recorded on the overtime
Page 14
spreadsheet. This has been passed to Facilities Management to contact Payroll to ensure the overpayment is recovered and the underpayment is corrected. 3.4 A HSCP employee has been overpaid £592.02 for 17 overtime hours keyed twice for period ending 28/02/23. The Service has agreed to recover this money. 3.5 A HSCP employee has been overpaid £88.68 for 4 hours overtime keyed twice for period ending. The Service has agreed to recover this money. Working Time Regulations 3.6 The auditor tested for employees that work a weekly average hours of more than 48 hours for the period 01/01/23 to 30/06/23. This calculation adds contracted hours and overtime hours. There were 38 employees meeting this criteria and 23 of them have a record on the payroll system to show they have selected to opt out of the Working Time Regulations. As a result, 15 employees have no record on the Payroll system of selecting to opt out of the Working Time Regulations. This information has been passed to the relevant senior managers to action. 3.7 The auditor tested for current employees with more than 1 primary contract. This identified 1 employee who has a 37 hours per week contract and a casual contract but no multi-post contract. This was passed to Resourcing who confirmed with the service that the employees’ casual contract should be terminated and this will be actioned by Payroll. Leavers Last Pay 3.8 The auditor selected a sample of 10 leavers that have been paid since they left. This testing resulted in the following findings: • late submission of 3 termination forms. • a termination form stated a leaver was entitled to 12 weeks pay in lieu of notice and although the correct amount was paid, it was wrongly coded to pay in lieu of holidays. 3.9 The auditor carried out additional testing to identify overpayments to leavers which have not been identified and rectified by the Payroll team. This test resulted in 10 potential overpayments that were passed to the Payroll Team to investigate as they were not recorded on the Payroll Overpayments Log and there was no evidence the overpayment had been rectified on the Payroll system. This resulted in a missed gross overpayment of £291.83 and Payroll advised an account will be raised. 3.10 The auditor tested for employees that left and restarted to check there was no overlap in dates. This identified 3 employees having more than one employee number for a period of less than 1 week. The Team Supervisor (Payroll) advised they have been set up as a new start by the Resourcing team at the request of the service and Resourcing should have checked to see if the employee was already on CHRIS and if so, they should have advised the service to create a new additional contract. Each employee found in this test now only has 1 employee number and no additional contracts. 3.11 There were 10 employees that that left within 21 days of starting. There were no findings to note from this testing. Salary Amendments 3.12 The auditor selected a sample of 10 salary amendments to carry out checks to ensure they were properly authorised and recorded properly on the Payroll system. The only finding to note was that 3 out of the 10 amendment forms were submitted late. Pay Adjustments
Page 15
3.13 The auditor tested for duplicate pay adjustments code to 0056 (Pay Adjustments – Sup). There were 6 duplicate payments paid to the same employee for the same amount on the same pay date. All were checked and there were no findings to report. 4 Internal Audit Opinion 4.1 Overall, reasonable assurance was obtained with regarding to the testing carried out on the HR Payroll system. Definitions of Assurance Levels: Substantial A sound system of governance, risk management and control exist, with internal controls operating effectively and being consistently applied to support the achievement of objectives in the area audited. Reasonable There is a generally sound system of governance, risk management and control in place. Some issues, non-compliance or scope for improvement were identified which may put at risk the achievement of objectives in the area audited. Limited Significant gaps, weaknesses or non-compliance were identified. Improvement is required to the system of governance, risk management and control to effectively manage risks to the achievement of objectives in the area audited. None Immediate action is required to address fundamental gaps, weaknesses or non-compliance identified. The system of governance, risk management and control is inadequate to effectively manage risks to the achievement of objectives in the area audited. NB The level of assurance given is at the discretion of Internal Audit.